Responsible Vulnerability Disclosure

This policy was last updated on 01/03/14.

Responsible Disclosure Policy

The information on this page is intended for security researchers interested in reporting security vulnerabilities to the Netflix security team. If you are a Netflix member and have questions concerning fraud or malware, please see the following support pages:

If you believe you've discovered a security vulnerability on a Netflix property or application, we strongly encourage you to inform us as quickly as possible and to not disclose the vulnerability publicly until it is fixed. We appreciate your assistance, and we review all reports and will do our best to address the issue in a timely fashion. To encourage responsible disclosure, Netflix will not bring a lawsuit against you or ask law enforcement to investigate you if we determine that a disclosure meets the following guidelines.

Responsible Disclosure Guidelines

Notify Netflix and provide us details of the vulnerability. Please provide us a reasonable time period to address the issue before public disclosure.

Provide an appropriate level of detail on the vulnerability to allow us to identify and reproduce the issue. Detail should include target URLs, request/response pairs, screenshots, and/or other information.

We will confirm your email and evaluate the validity and reproducibility of the issue. For valid issues, we will work to fix the issue and keep you appraised of progress.

Do not request compensation for security vulnerability reports either from Netflix or external vulnerability marketplaces.

Do not phish or social engineer employees or customers of Netflix.

Do not run automated scanning tools and send us the output without confirming the issue is present. Security tools often output false positives that should be confirmed by the reporter.

Vulnerability Categories We Encourage

We are primarily interested in hearing about the following vulnerability categories:

Cross Site Scripting (XSS)

Cross Site Request Forgery (CSRF)

SQL Injection (SQLi)

Authentication related issues

Authorization related issues

Data Exposure

Redirection Attacks

Remote Code Execution

Particularly clever vulnerabilities or unique issues that do not fall into explicit categories

Out of Scope Vulnerability Categories

The following vulnerability categories are considered out of scope of our responsible disclosure program and will not be eligible for credit on our researcher list.

SSL vulnerabilities related to configuration or version

Denial of Service (DoS)

User enumeration

Brute forcing

Secure flag not set on non-sensitive cookies

HTTPOnly flag not set

Logout Cross Site Request Forgery (CSRF)

Issues only present in old browsers/old plugins/end-of-life software browsers

HTTP TRACE method enabled

Vulnerability reports related to the reported version numbers of web servers, services, or frameworks

Clickjacking on pages without authentication and/or sensitive state changes

Vulnerability reports that require a large amount of user cooperation to perform unlikely or unreasonable actions which would be more symptomatic of a social engineering or phishing attack and not an application vulnerability (e.g. disabling browser security features, sending the attacker critical information to complete the attack, guiding the user through a particular flow and requiring them to enter malicious code themselves, etc.)

How to Report a Security Vulnerability

Please email security-report@netflix.com to report security vulnerabilities to Netflix. If you feel the email should be encrypted, our PGP key is available below.